10
votes
1answer
2k views

Effects of DDoS attacks on memory use under Linux

Can someone whose Linux system is under DDoS attacks give me exact data on the effects of the Low Orbit Ion Cannon (LOIC), the High Orbit Ion Cannon (HOIC), Slowloris, PyLoris, Hping etc. on memory ...
2
votes
3answers
10k views

What sites are still vulnerable to FireSheep?

Am doing a Firesheep Demo in a few weeks as a security awareness project. However I can't seem to get it working, and I'm wondering if it's just because the handlers it ships with are now outdated ...
0
votes
2answers
164 views

How much security should I use for my web application?

My question is, for a "normal" site, what do you think is enough to secure against methods used by "script kiddies"? For example, SQL injection, XSS, and stuff like that. Same question for password ...
2
votes
1answer
1k views

How can I tell if a DNSSec zone is protected using NSEC3 (versus NSEC)

This answer describes how DNSSec might permit "Zone walking"... where a bad guy can extract all the DNS records from a DNSSec enabled zone. NSEC3 is an update that prevents this. (See bottom of this ...
2
votes
1answer
607 views

question about implicitly tags in ASN.1

From the X.509 RFC, in the "Implicitly Tagged Module" section: CRLDistributionPoints ::= SEQUENCE SIZE (1..MAX) OF DistributionPoint DistributionPoint ::= SEQUENCE { distributionPoint [0] ...
4
votes
1answer
3k views

Checklist for configuring WinRM Security settings on servers

WinRM has a very difficult to use command line interface and that leads me to believe some settings will be easily reconfigured, overlooked, and eventually exploited. In other words, insecurity ...
13
votes
2answers
1k views

What are prudent security precautions to take for business travel by people with access to sensitive info?

The New York Times had a front-page article today: Traveling Light in a Time of Digital Thievery, aka "Electronic Security a Worry in an Age of Digital Espionage". Former director of US national ...
5
votes
2answers
1k views

How does multi factor authentication modify the AD authentication process?

I'm trying to understand what would have to be updated to make Windows-based systems support multifactor authentication. Possible things that might have to be modified: Active Directory / Domain ...
6
votes
2answers
2k views

What are the dangers of storing webserver temp files in the /tmp/ folder?

I have configured my first publicly accessible nginx server. I have configured it to use a /tmp/nginx folder to store temp files. This includes the body of http requests, proxy files etc. The /tmp ...
6
votes
5answers
2k views

Which is the most vulnerable to MITM attacks, SSL or SSH?

Which is the most vulnerable to MITM attacks, SSL or SSH? Here's the scenario, you have 20 minutes to set up a web proxy like this: Laptop -> Chrome Browser -> Web Proxy -> Internet You must secure ...
5
votes
1answer
283 views

What is the security impact of changing PowerShell's PSLanguageMode?

A vendor is asking me to change the PSLanguageMode from within IIS on my Exchange server(s). What potential vulnerabilities am I opening myself up to? I'm surprised to see this option present within ...
5
votes
3answers
4k views

How to scan USB drive with clamav on Linux

Is there a way to scan the entire drive including auto-run and all partitions, including the master boot record (MBR)?
1
vote
4answers
539 views

Completely wiping a HDD (i.e. nothing is recoverable) [duplicate]

Possible Duplicate: How can I reliably erase all information on a hard drive? I'm looking to see if there's a method that can completely wipe out the content of a HDD, so that nothing ...
1
vote
1answer
328 views

Should I mount my mac Truecrypt Volume elsewhere?

I've read in various places to not mount your truecrypt volume in the same place as your Dropbox or Sugarsync folder. I believe this only matter for Mac/Linux, but I need some verification. On a Mac, ...
0
votes
1answer
522 views

How does FileVault 2 work with multiple decryption keys?

With FileVault 2, you can encrypt the hard-drive such that users on the computer can decrypt it with either of their passwords How does this work?
10
votes
3answers
2k views

What Twitter #hashtags apply to IT Security

I'm trying to search twitter for evidence of near-realtime alerts or updates regarding security issues. What hashtags are common or popular in the IT Security world?
2
votes
1answer
134 views

DNS Cache poisioning examples, or other criteria when a client ignores a response

Is there a concise set of rules that describe what 99% percent of DNS responders accept? Conversely, are there are set of rules that define when DNS queries are invalid? I would think that the ...
6
votes
5answers
3k views

GET request with different IPs

I need to check vulnerability in my polling system. So I need to send GET requests but every time with different IPs. Can anyone suggest something?
2
votes
1answer
120 views

Should the email server/application be protected by 2 factor authentication? What applications should be protected?

When should email be protected by 2 factor authentication? Suppose a given company is in an industry where two factor authentication is offered to some or all of its clients. Does this mean that it ...
0
votes
1answer
337 views

What regulations *require* multi-factor authentication?

What industries require multi-factor authentication? Please include the following information: Country Industry Regulation name Additional information as you see relevant. Some additional ...
-2
votes
3answers
388 views

Available alternative DNS protocol not another dark-net [closed]

Hi does any one knows any DNS alternative Protocols ? If so what is the most used ? Is easy to setup ? Is easy to have two DNS protocols one where you connect to the Common Internet and the other ...
10
votes
2answers
3k views

How does DNSSec work? Are there known limitations or issues?

Based on information from this site, DNSSec is needed to protect us from a number of DNS and SSL / TLS hacks, including: DNS spoofing, especially on wifi or shared medium Registrars that abuse their ...
3
votes
1answer
2k views

How can I find the process that is trying to use smtp to send email?

Previously I asked Who (which process) is calling curl? and I got very good answers (this answer in particular) which basically replace the curl binary with a shell script that logs each call to curl ...
7
votes
5answers
13k views

Does chatting over Skype expose my IP address?

Is there a way to identify a person's IP address in Skype, when you're chatting with them? Does this depend on their Skype settings? And if you've recorded chat messages, can they lead to the actual ...
0
votes
2answers
2k views

List of unpatchable exploits in MS Exchange 2003 [duplicate]

Possible Duplicate: Where can I find a list of un-patched CVEs for a specific piece of software? MS Exchange 2003 is no longer supported by Microsoft since April 2009. However the ...
9
votes
1answer
914 views

Would it make sense to use Bcrypt and PBKDF2 together?

I've read various opinions about whether Bcrypt or PDBKF2 is a better key derivation hashing method. The answer seems to depend on a lot of complicated factors that are not easy to analyze. Would ...
10
votes
3answers
106 views

What is the term to use when logging an event where a user downloads or prints PHI?

My application logs accesses to PHI. I need to add a log item for things like downloading and printing. Is there a general term that I can use to describe these events? I'm thinking something like ...
9
votes
1answer
22k views

How to spoof a cell phone tower (cell site, base station) — homemade IMSI-Catcher

An answer to a recent question has given me an idea for a school project (security CS program). Also, an active attacker (with a fake base station) can potentially force a mobile phone to use ...
7
votes
2answers
1k views

Why should I restrict the content type of files be uploaded to my site?

We are building an application where users can upload resumes in our system for our administrators to download. We are having a debate about restricting the content type of the files that can be ...
3
votes
1answer
2k views

My S/MIME certificate (created with OpenSSL) does not match my email address

I created a certificate with OpenSSL and following commands: openssl req -x509 -nodes -days 365 -subj '/C=DE/ST=state/L=city/CN=hostname' -newkey rsa:1024 -keyout mycert.pem -out mycert.pem ...
2
votes
1answer
201 views

Are COMET installations immune to “Slow TCP Reading” DoS on Windows? (Such as SignalR or WebSync)

My understanding is that COMET implementations of WebSync and SignalR do not directly use IIS and are a few layers lower on the ISO model. After reading Qualys's blog regarding slow TCP reading, I ...
1
vote
2answers
4k views

What needs to be done on a Citrix Netscaler to protect from SSL Renegotiation attacks?

I'm under the impression that the TLS/SSL renegotiation hack has been fixed. I'm not sure if the software has to be deployed on the server side, client side, or both. Based on this blog, TLS ...
7
votes
1answer
849 views

Open Problems in Security?

I know it might seem a bit too much theoretical, but I was wondering if there was some list of known open problems in security? In a similar way that there are open problems in Theoretical Computer ...
5
votes
3answers
2k views

confused: computer security & software development career tracks [duplicate]

I'm a recent computer science graduate. I like computer security and want to be a security architect. I googled it and saw that the start point is to be a system administrator, but system ...
4
votes
4answers
8k views

Router Ports open

What ports on my home router should be open, say if I'm only using it for browsing the internet. Right now these four are open, 23/tcp open telnet 53/tcp open domain 80/tcp open http ...
3
votes
1answer
2k views

Storage of 'secrets', keystores, HSMs and the rest

I've been digging for the past few days into storage of sentitive data. If I store this data in a database, I believe the general accepted practice is to store sensitive data encrypted, for various ...
2
votes
1answer
168 views

Firewall Considerations with PGP Universal

The PGP Universal server is a fairly complex piece of work that provides several different services. When constructing firewall rules I am trying to determine what implications there are for opening ...
1
vote
3answers
937 views

OWA Keep-Alive in http, even though it should be forced https

Yesterday, I got an alert from a client's IDS that a Base64 auth packet was detected. Looking at the ASCII decode, I can see that it is for their OWA (Outlook Web Access), and indeed, the auth info ...
48
votes
6answers
14k views

How hard is it to intercept SMS (two-factor authentication)?

A lot of two-factor authentication mechanisms use SMS to deliver single-use passphrase to the user. So how secure is it? Is it hard to intercept the SMS message containing the passphrase? Do mobile ...
8
votes
1answer
449 views

How to apply IT Security knowledge to Home Security?

Today my car got stolen from my house, and it is possible the person who did it has access to my home. I try to take secure measures online to maintain security, yet it seems I never paid attention to ...
0
votes
1answer
354 views

Are export ciphers allowed in DTLS 1.0?

In RFC 4347 for DTLS, I am unable to find the cipher list to be supported. The RFC mentions it as a set of changes from TLS 1.1 (RFC 4346). TLS 1.1 prohibits use of export ciphers. Are export ...
0
votes
5answers
909 views

What voip client support manual encryption?

In pidgin there is a plugin that we can use to encrypt our messages in chat windows .. Is there anything simular for voip (pc to pc) ? any client that support manual encryption for voice data?(linux)
3
votes
3answers
2k views

What are some recommended open source tools for web browser history analysis?

I'm looking at a series web browser histories from various browsers (IE, Chrome, Firefox, etc) and need to do some analysis. All of these browsers store data much differently, but I was wondering if ...
3
votes
2answers
164 views

Teaching security concepts

I think it would be nice to teach security concepts by giving practical examples. I am looking for some practical cases for x509 certificates, kerberos and SET. How could I know an ecommerse site ...
1
vote
2answers
266 views

References to issues of putting backdors into opensource (like OpenBSD) by FBI or CIA [closed]

There are articles on the Internet (e.g. this) that claim that the FBI/CIA injected security backdoors into OpenBSD. I'd like to know if there are any other references to this issue. This would help ...
6
votes
1answer
4k views

Getting a Root CA accepted in systems and browsers

I would like to ask about the procedures for a given CA to get one of its root CAs (SSL issuance CA) to get accepted and installed as a trusted root CA in operating systems and browsers.
3
votes
2answers
827 views

Securely expose WebService from Enterprise Network to Internet Client

(coming from stackoverflow) Are there any standards (or certified solutions) to expose a (Web-)Service to the internet from a very security-sensitive network (e.g. Banking/Finance)? I am not ...
2
votes
2answers
350 views

Legal Risk to unpatched servers

Since one of the 10 domains on the CISSP is legal/governance, I figured this would be the best place to ask. I recently did a security assessment for a non-profit. I found that their systems needed ...
5
votes
10answers
611 views

Can a compromised mobile phone be used to penetrate a desktop or server?

Can a compromised mobile phone be used to penetrate a desktop or server, such as when you plug the phone into the server or desktop for plug and play? I don't know what protocol the transfer is ...
1
vote
1answer
304 views

Trying to land a shell on a remote service

Here's the scenario, part of a wargame/CTF type exercise. There is a vulnerable program running as a service on the remote host. I have access to a copy of the binary, which has a stack overflow from ...

15 30 50 per page